Function atomicWrite

packages/migration-legacy/src/atomic-write.ts:10–19

(path: string, data: string)

 * write that overwrites an existing user-owned file.
 */
export async function atomicWrite(path: string, data: string): Promise<void> {
  const tmp = `${path}.${process.pid}.tmp`;
  // Migrated config/MCP files can carry provider API keys. Create them
  // private (0600) so they are never group/world-readable, even when the
  // target home directory itself has permissive permissions. `chmod` covers
  // the case where a stale temp file from a crashed run already exists.
  await writeFile(tmp, data, { encoding: 'utf-8', mode: 0o600 });
  await chmod(tmp, 0o600);
  await rename(tmp, path);
}